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1.0 PROGRAMMATIC RISK MANAGEMENT AND RISK 
REGISTER DEVELOPMENT 

The purpose of this memorandum is to define objectives and protocols for the development of 
risk registers by regional teams for the implementation of a consolidated risk management 
process consistent with the scope and magnitude of the California High Speed Train Project 
(CHSTP). It is intended to provide more specific guidance to the regional teams in development 
of their individual risk registers and, more generally, carrying out risk management efforts in line 
with the principles and methodology provided in the program’s Risk Management Plan. This 
Risk Register Protocol (RRP) memorandum is considered to be living document and will be 
periodically revisited and modified as necessary. 

Risk Management encompasses all aspects of the identification, assessment, analysis and 
management of risk (both threats and opportunities). We have a broad definition of what is 
meant by risk. A “risk” is an uncertain future event - internal or external - with the potential to 
impact the project objectives. “Risk Management” is an explicit, systematic process to identify, 
assess and manage these uncertain events, so as to maximize the chances of achieving the 
program (and regional project) objectives. The protocols described in this memorandum support 
risk management by systematizing the efforts to identify risks and develop and communicate 
action plans, as embodied by the risk register. As such, the risk management process as a 
whole helps us understand and manage the relationships between the business environment, 
our strategic objectives, the risk to achieving these objectives, and our actual performance. 

The primary risk management deliverable for the regional teams is the risk register. The risk 
register will contain all individually identified risks to the team’s budget or schedule, including, 
as necessary, system safety risks with the potential to impact cost and/or schedule. It will be 
developed in conjunction with the cost and schedule estimates and together, these should 
provide a complete picture of not only what is intended with regards to cost and schedule, but 
challenges (and opportunities) with the potential to affect these plans. 

PMT Risk Analysts will integrate the information developed by the Regional teams in the risk 
registers with cost and schedule estimates and risks identified by other elements of the program 
team to develop a complete picture of the challenges facing the project and inform contingency 
levels. In addition, this process will established levels of confidence for particular cost and 
schedule outcomes to better understand and communicate the potential impacts of ‘scope- 
creep’ and other issues to the Authority. 

The risk registers themseives serve two basic functions: 

1. It is an action plan - a complete risk register is not limited to an identification or 
assessment of risks, it must specify what is being done by the project team to 
overcome these challenges, who is responsible for doing it and when it will be 
done. 

2. It is a communication tool - it provides a concise summary of the challenges 
currently facing the project together with the what, who and when of their 
management for other team members and regions as well as management and the 
Authority. 

All processes and protocols presented in this memorandum are intended to serve one or 
both of the above functions and all risk register development efforts should be carried 
out with them in mind. 

Figure 1 summarizes the risk register development process, principles and objectives intended 
to support these two core functions. They are discussed in more detail in the following sections. 
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Risk Register Development Process 


Principles 

• Ownership-eachgroup,function, and/or 
team will comply with and embed Project 
requirements, process and procedures 
for risk management; risks will be held by 
individuals at the lowest organizational 
level for which management is feasible. 

• Business alignment-all key decisions 
supported by explicit consideration of 
riskwith balanced consideration of 
safety, regulatoryand commercial 
factors. 

• Action oriented-risks and opportunities 
linked to response plans with timely 
tracking of actions. 

• Review - risk management processes will 
be documented and included in the 
management system. 

• Reporting-on risk and the effectiveness 
of associated key controls and risk 
responses, following normal reporting 
lines through the Program. 


Risk Identification 

• Identify specific risk events and opportunities 

• Outline root causes and effects associated with each risk event 

• Associate risks with specific category or sub-category of the Capital Cost 
Estimating Methodology p'M 1.1.19) 


Responsibilities: 

• Regional and Systems Risk Manager(s) 



Risk Assessment 


• AssesspotentialCost/ScheduleImpacts(S)foreach risk 

• Assess ProbabHRy (P) for each risk 

■ Specify any sources or assumptions underlying the assessment 
Responsibilities: 

• Regional and Systems Risk Manager(s) 


Objectives 

• Link risk and returns-should enhance 
the Project's capacity to anticipate 
events, assess risks and set risk 
tolerances consistent with achieving 
objectives; 

• Rationalize resources-more effectively 
deploy resources by identifying key 
drivers of Development and Delivery, 
thereby reducing overall capital 
requirements and improving capital 
allocations; 

• Exploit opportunities-aid the 
identification, and ability to take 
advantage of, positive events quickly and 
efficiently; 

• Reduce surprises and losses-identify 
potential adverse events, assess risks and 
establish responses, thereby reducing 
surprises and related costs, schedule 
delays or losses; 

• Reportwith greater confidence- 
internal and external information that is 
reliable, timely and relevant; 

• Satisfy legal and regulatory 
requirements-ensure compliance with 
legal and regulatory requirements and 
identify risks of non-compliance. 


Risk Analysis 

■ Program Risk Managerto perform as needed 


Risk Management 

• Prioritize risks 

• Decide mitigation measures (avoid, reduce, transfer, accept, or optimize) 

• Identify specific mitigation for critical risks 

• Identify responsible parties to execute mit^ation rrreasures 


Responsibilities: 

• Regional and Systems Manager(s) in consultation with Regional and Systems 
RiskManager(s) 

• For Regional Teams, the Regional Project Managers will be responsible for 
assigning personnel to execute mitigation measures. 



Monitor & Review 


• Enact mit^ation measures 

• Monitor progress of the mitigation nreasures 

• Review effectiveness of the mit^ation measures 

Responsibilities: 

• Regional and Systems Risk Manager(s) 


Figure 1 Risk register deveiopment principies, objectives and process summary 
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2.0 Personnel Requirements and Primary Risk Management 
Responsibilities 

As a member of their staff reporting directly to the regional project manager, each regional team 
is expected to have a qualified, experienced risk manager to oversee implementation and 
execution of the protocols in this document.The principal personnel involved with risk 
management on CHSTP are given below, together with their primary responsibilities. 

Program Management Team 

Program Risk Manager. Establish and oversee risk analysis methodologies and procedures; 
integrate and report on information from Risk Analyst, Regional Risk Managers and other 
program elements (e.g. Railroad Operations, EMT, Environmental, Staging / Procurement). 

Risk Anaiyst. responsible for integrating information received from regional teams (risk register, 
cost and schedule estimates) to inform cost and schedule contingencies and ensure consistent 
application of cost and schedule standards and procedures across regions and sub-systems as 
they relate to the risk management process 

EMT Risk Manager, develop risk registers for Rolling Stock, Train Control, Traction Power/OCS, 
Communications and Maintenance (these registers are strictly limited to risks with potential cost 
or schedule impacts - System Safety aspects are a separate effort) and establish appropriate 
ranges for cost and duration ranges that reflect residual uncertainty, i.e. variability exclusive of 
individually identified risks. 

Regional Consultant Teams 

Regionai Risk Manager(s): develop information required for risk registers, facilitating the 
identification and assessment of individual risks together with appropriate mitigations following 
policies and procedures; one/region, eight total 
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3.0 Risk Register Deveiopment Process 

While there will be a number of other potential impact areas specified for assessment (e.g. 
environmental, construction safety, legal/community relations), these can, and generally will, be 
translated and specified in terms of potential cost and/or schedule impacts to the project. For 
this reason and for purposes of brevity, the discussion that follows will only reference cost and 
schedule as potential impact areas. This should not be understood to mean that project 
considerations with regards to risk will be limited solely to these impact areas. 

Assessments of cost and schedule risks will ultimately be specified in quantitative or semi- 
quantitative (numeric ranges) terms. In addition to allowing objective comparisons of risk 
exposure across regions and systems that qualitative specifications such as ‘high’ or ‘low’ do 
not, quantitative specifications allow tools such as Monte Carlo methods to be employed for 
schedule and cost risk analysis. Specifically, it allows objective comparisons between individual 
risks for prioritization, development of a risk exposure profiles and direct comparison of this risk 
exposure to available contingency. 

When system safety risks have potential cost or schedule implications the mitigations to such 
system safety risks (or hazards), where not accounted for in the base estimate, will be carried 
as risks on the appropriate risk registers until a decision is made by system safety personnel if 
or what mitigations will require changes to the design on which the current estimate and 
schedule is based. At such time, the delivery risk engendered by the possible mitigation to the 
system safety risk will transition from the risk registers to the cost and/or schedule estimate. 
More discussion is included on this situation in the following sections. 

Risk register development proceeds through the following stages, with the Identification, 
Assessment and Management elements forming the core of the Risk Register: 

• Project Definition 

• Identification 

• Assessment 

• Analysis 

• Management 

• Monitor and Review 

As the project moves forward, risks are periodically revisited and reassessed to reflect the 
current status of the program. Regional teams are expected to maintain their risk registers and 
these registers should reflect the current status of the Team’s risk management efforts. 
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3.1 Risk Management Principles 

As stated earlier, the risk management process as a whole helps us understand and manage 
the relationships between the business environment, our strategic objectives, the risk to 
achieving these objectives, and our actual performance. It is founded on the following general 
principles: 

1. Ownership - each group, function, and/or team will comply with and embed Project 
requirements, process and procedures for risk management and individual risks wiii be 
heid by specific, named, individuais at the iowest organizationai /eve/ for which 
management is feasibie. 

2. Business aiignment- all key decisions are to be supported by an explicit consideration 
of risk with balanced consideration of safety, regulatory and commercial factors. 

3. Action oriented - risks and opportunities must be linked to response plans with timely 
tracking of actions. 

4. Review - risk management processes will be adequately documented and included in 
the management system. 

5. Reporting - reporting on risk and the effectiveness of associated key controls and risk 
responses is an integral part of management information, following normal reporting 
lines through the Program. 

Identifying and regularly re-evaluating the risks facing the project, prioritizing these risks, and 
implementing appropriate actions requires a clear focus on actions with a close link to planning 
and performance management. Included is the careful balancing of economic and safety 
factors. Generally speaking, an effective Risk Management effort should be able to provide 
answers to the following questions: 

• Are our objectives at risk? 

• What are the major risks facing the Project? 

• What is our current and future risk profile? 

• How well are risks controlled? 

• Are implemented controls working as they should? 

• Are corrective measures implemented as planned? 

It is neither feasible nor desirable that Risk Management be the sole responsibility of a single 
individual or isolated group within the project team. In addition to active participation during the 
identification, assessment and management stages, each Regional Risk Manager, in 
conjunction with the Regional Project Manager and Regional Manager, is expected to: 

1. Comply with the risk management principles outlined in above. 

2. Adopt, or ensure compliance with, the roles and responsibilities specified in this 
document, as appropriate 

3. Specifically report on key risks, risk management efforts and status of all identified risks 
via a current risk register on a monthly basis, in the prescribed way, using standard 
terminology and measures 
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These principles, roles and responsibilities ultimately serve to accomplish the following 
objectives: 

• Link risk and returns - fundamentally, Risk Management should enhance the Project’s 
capacity to anticipate events, assess risks and set risk tolerances consistent with 
achieving objectives; 

• Rationalize resources - Allowing the project to more effectively deploy resources by 
identifying key drivers of Development and Delivery, thereby reducing overall capital 
requirements and improving capital allocations; 

• Exploit opportunities - aid the identification, and ability to take advantage of, positive 
events quickly and efficiently; 

• Reduce surprises and losses - identify potential adverse events, assess risks and 
establish responses, thereby reducing surprises and related costs, schedule delays or 
losses; 

• Report with greater confidence - Preparing internal and external information that is 
reliable, timely and relevant; and 

• Satisfy legal and regulatory requirements - Supporting efforts to ensure compliance with 
legal and regulatory requirements and identify risks of non-compliance. 
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3.2 Development Process 

Project participants will work on different and/or multiple high-speed train corridors and will be 
working at varying stages of project development concurrently. Recognizing that the risk 
management activities require involvement of multiple project participants having different roles 
and responsibilities on the project, the table below provides a summary view on how risk 
management responsibilities for the development of the risk register are going to be shared. 

Error! Reference source not found, identifies the areas of responsibility for the California 
High-Speed Rail Authority (Authority), Program Risk Management Team (PRM) and Regional 
Consultants (RC) at each major step in the Delivery Risk Management processes. These 
responsibilities are described as Approve (A), Review (R) and Perform (P). 


Risk Management Stage 

Authority 

PRM 

RC 

1 

Identify Risk(s)/Opportunities 
and keyed to Cost 

Estimating Methodoiogy 


R 

p 

2 

Assessment: Potentiai 
impacts, probabiiity and 
statement of assumptions, 
supporting doc. 


R 

p 

3 

Anaiysis 

- 

P 

R 

4 

Management: identify 
potentiai mitigations, assign 
responsibiiity for carrying out 
these mitigations 

A 

R 

P 

5 

Monitor and Review 

- 

R 

P 

Note: A = Approve, R = Review, P = Perform 


Figure 2 summarizes the process with areas of risk register development that are primarily the 
responsibility of the Regional Risk Manager and their team in orange. 


yCALIFORNIA 


Page 7 


CALIFORNIA HIGH SPEED RAILAUTHORITY 
































California High Speed Train Project 


Risk Register Development Protocol, R1 


Risk Identification 


■ identify 
specific risk 
events 

■ Outline root 
causes and 
effects 
associated 
with each risk 
event 

• Associate risks 
with specific 
category or 
sub-category 
of the Capital 
Cost 

Estimating 
Methodology 
(TM 1.1.19) 

I 

I 

I 

I_ 


r-- 

I 

I 

I 

_I_ 

Risk Assessment 


■ Assess 

• 

potential 

■ Assess 

cost/ 

probability 

schedule 

(P) for each 

impacts (S) 

risk 

for each ri^ 


Specify any sources or 


assumptions underlying the 
assessment 


Regional 
Consultants 
prioritize individual 
risk for 
management 


RiskAnalysis 


• Perform 
Monte Carlo 
Simulation 
Analysis to 
determine 
Risk 

Exposure 

profile 

• Contrast/ 
compare Risk 
profile with 
established 
contingency 

■ Prioritize 
risks 


1 

I 



PC's responsibility 
PRM's responsibility 


Risk Management 


■ Decide 
management 
strategy (avoid, 
reduce, transfer, 
accept, optimize) 

■ Identify specific 
mitigation for 
critical risks 


Monitor & Review 


■ Enact 
mitigation 
measures 



Monitor 
progress of 
the mitigation 
measures 


• Identify 
responsible 
parties to 
execute 
mitigation 
measures 


• Review 
effectiveness 
ofthe 
mitigation 
measures 



Figure 2 Delivery Risk Management process flowchart showing the five main stages of risk management 
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3.2.1 IDENTIFICATION 

Proper risk identification considers the program’s objectives and identifies events or situations 
that might act against these objectives (risks) or advance these objectives (opportunities). It 
consists of four elements: 

• Description of the risk/opportunity 

• Associated cost and/or schedule elements 

• Specification of the Cause/Effect relationship 

Descriptions and cause/effect relationships will be refined over time. Initially, it will suffice if it is 
clear what the assumption is to participants and can be generally understood by outside 
reviewers. 

There are two primary goals for this stage: 

1. Development of a comprehensive list of assumptions underlying the cost and schedule 
estimates 

2. Inclusion of enough description in the form of the description itself and the cause/effect 
relationship that the team will be able to move forward with the assessment stage 

Specifying a cause/effect relationship serves three purposes: 

1. Establishes a clear understanding and definition of the issue under consideration that 
general risk/opportunity statements do not 

2. On the cause side, suggests possible mitigation measures once the management stage 
is reached 

3. On the effect side, serves to tie the identified risk or opportunity to the project’s 
objectives, presaging the impact assessment 

Given the risk register development process’s reliance on the expertise and judgment of the 
contributors, it is critical that Risk Managers involve (and motivate) the right people. It is 
recommended that individuals with the following areas of expertise be involved with the initial 
risk identification, assessment and management workshop and as required for follow on risk 
management efforts by the Regional Risk Manager: 

• Implementation Planning 

• Environmental Planning 

• Funding/Approvals 

• Project Management 

• Engineering Design 

• Architectural Design 

• Cost Estimating 

• Scheduling 

• Budgeting/Controls 

• Real Estate 

• Constructability/Contractor 

• Operations 
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• Other Technical (e.g. Legal, Permitting, Procurement) 

• Risk Facilitation 

The above are general recommendations - the particulars of a region may not require all areas 
indicated or may require other, additional areas of expertise. Regional Risk Managers will, 
however, be expected to submit a record of personnel together with their area of expertise that 
indicates appropriate personnel with requisite experience were involved in risk identification, 
assessment and primary mitigation activities. It is understood that the Risk Manager alone will 
not have the expertise to identify and assess the risks for a program of this size or complexity. 
Selecting and motivating the right people, especially in the context of risk workshops, will be one 
of their primary duties. 

The PMT will provide personnel to facilitate the initial risk workshop in each region to establish a 
consistent basis for future efforts by the Regional Risk Managers. 

Integrating Risk Management with Costand Schedule Estimating 

Risk identification should be done in conjunction with the development and review of cost and 
schedule estimates. The first stage of identifying risks should be a clear delineation of all 
assumptions (both positive and negative) that underlie the current estimates and schedules. 

Risk Managers will ‘walk’ the cost estimate with the project team, noting any assumptions. The 
same should be done with the schedule with respect to overall structure of the schedule and the 
individual activity durations. The project team should identify and note these assumptions, 
determine the validity of these assumptions and, ultimately, how likely they are to remain valid 
as the project progresses. Making these assumptions explicit should be the first step in the 
development of the risk register. 

The easiest and most effective way to accomplish the above is to make the cataloguing of 
assumptions part of the development process for the cost and schedule estimates, beginning 
with the 15% design level. Regional Risk Managers should also review hazards identified as 
part of System Safety efforts with the project team. In particular, any proposed mitigations to 
these hazards with cost or schedule implications should be checked against the cost and 
schedule estimate to see if they have been accounted for. If not, the mitigation needs to be 
included in the risk register as a potential change to the cost/schedule. For such risks, the 
potential impact is the estimated cost of the mitigation and the likelihood is the probability that 
this mitigation will be enacted. For these risks. Risk Managers will work with their teams to 
develop likely cost/schedule impacts with System Safety personnel providing guidance for the 
probability assessment. This issue will be discussed further in the following sections. 

Regional Risk Managers are expected to be fully aware of all assumptions embedded in 
the cost and schedule estimates and what they indicate with regards to what is, and 
more importantly, what is not, represented by the cost and schedule estimates. 

Once the above basis has been established. Regional Risk Managers can move to more ‘free¬ 
form’ identification with a review of hazard checklists (one example is provided in Appendix C - 
General Hazard Checklist), plans and profiles and historic problem areas on other similar 
projects (as given in the RMP, including reference works cited there). 

When these reviews point up risks not associated with the previously identified assumptions, 
RCS Risk Managers should work with the project team to develop descriptions and cause/effect 
relationship and associate the risk with the appropriate cost or schedule element. 
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3.2.2 Assessment 

Based on the risk and its potential impact on the project’s objectives, each risk will be assessed 
for potential impact and probability in semi-quantitative (numeric ranges) or quantitative (specific 
dollar amount or duration) terms. A risk assessment scoring guide showing the quantitative 
likelihood and impact ranges is provided in the Appendix B - Risk Scoring Guide, and should be 
used when assessing both the impact and probability of risks. Any support for this assessment 
(e.g. contract terms, relevant past projects, formulas) should be recorded at the time the 
assessment is made. As with the rest of the stages, assessments will be periodically revisited 
and refined. 

Impacts should be assessed in terms of identified project objectives and a single risk may have 
numerous potential impacts. While there are a number of other potential impact areas specified 
for assessment (e.g. environmental, construction safety, legal/community relations), these can, 
and generally will, be translated and specified in terms of potential cost and/or schedule impacts 
to the project. This should not be understood to mean that project is only concerned with risks 
that explicitly impact cost or schedule. 

The goal for assessment is two-fold: 

1. Develop broadly accurate (as opposed to precise) estimates of potential impact and 
probability 

2. Ensure relative accuracy with a consistent approach 

With regards to the second point, an inconsistent approach that inaccurately elevates the 
importance of some risks and lowers others will distort management priorities and hamper risk 
management efforts.. 

The assessment has two broad deliverables: 

1. The assessment itself 

2. Assumptions or supporting information underlying these assessments. 

The assessment is composed of two parts: 

1. Potential impact of the risk (quantified as cost or duration ranges) 

2. Probability that the event or situation will occur. 

Risk Managers should make a clear delineation between impact assessment and 
probability assessment and proceed in the order indicated above. If these two steps are 
not clearly separated, especially in a workshop format, there is a tendency for participants to 
conflate the two. For example, risks that the assessors feel are low probability may end up with 
lower impact assessments than would otherwise be justified. As the assessment motivates the 
prioritization for management, risks that in actuality have the potential for high or even 
catastrophic impacts on budget or schedule may not receive the management attention that 
they should. Risk Managers should explicitly ask participants 

‘Assume the risk event or situation happens, what would the impact be?’ 

Only once some consensus (in the case of a group) impact assessment has been established 
should the Risk Manager begin considering the probability assessment. Once the probability 
assessment is made, the risk is considered fully ‘quantified’ and the risk exposure for the project 
due to the individual risk is given by 

Risk Exposure = Impact X Probability 
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An even more common problem than the conflation of probability and impact is the tendency of 
participants to confuse the manageability of a risk with the risk exposure it represents. 
Significant problems arise from mixing assessment and management discussions in the context 
of Risk Management. Potentially severe risks for which participants can think of a number of 
solutions are inevitably downgraded during assessment; otherwise minor risks for which none of 
the participants can readily think of solutions end up with higher exposure values than are 
otherwise justified. 

Risk Managers must draw a bright line between assessment and management 
discussions on the first identification, assessment, (prioritization), and management 
cycle. It is likely that they will have to actively delay management discussions until the 
assessment is complete. They should also alert participants to the problem so that they 
can defend against this bias in their assessments. 

Risk Scoring 


As indicated below, the risk assessment scoring employs relatively broad ranges for both 
potential impact and probability. 


Likelihood 

Very 
Unlikely 
(1 -10%) 

Unlikely 
(11 - 35%) 

50/50 
chance 
(36 - 64%) 

Likely 
(65 - 89%) 

Highly 
Likely/ 
Near 
certainty 
(90 - 99%) 

Cost 

Impact 

($) 

Tens of 
Thousands 
($10,000 to 
$100,000) 

Hundreds 

of 

Thousands 
($100,000 
to$1 Mil) 

Millions 
($1 to $10 
Mil) 

Tens of 
Millions 
($10 to 
$100 Mil) 

Hundreds 
of Millions 
(>$100 Mil) 

Schedule 

Impact 

(workdays) 

Days 

Weeks 

1-3 Months 

3-12 

Months 

Year or 
longer 


Where more specificity is justified, either on the initial assessment or subsequent reviews, the 
assessment team can supply their own, narrower range. Additionally, if a particular value 
between the lower and upper bounds of the assessment judged more likely than others it can be 
designated as ‘Most Likely’. 

Narrower probability ranges than those above can also be used. Given the nature of delivery 
risks, however, it is generally less likely that narrower ranges are justified. 

When assessing a risk that may impact multiple points or segments, the description and 
cause/effect relationship can help determine whether it is more appropriate to break the risk up 
into multiple instances, each affecting a specific point or segment (such may be the case with 
ROW risks where there are issues specific to a particular parcel) or keep it as a single risk with 
an impact assessment that represents the total potential cost of the risk. In either case, the 
decision can be reviewed once specific mitigations are identified. If the same mitigation action is 
likely to affect the risk for all the individual instances equally, consider treating it as a single 
large risk. If different mitigations will need to be applied at different points on the alignment, it is 
recommended that the risk be broken up into individual instances. 
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An exception to the relatively wide probability ranges given above commonly occurs as the 
project progresses: the case when the underlying risk event or situation has occurred but the 
cost/schedule impact on the project is still uncertain. The example mentioned earlier - when the 
delivery risk is mitigation to a hazard identified as part of System Safety efforts - is a common 
case. Once (if) it is determined that the mitigation will be incorporated into the design, the 
probability is designated as 100% with the risk stemming from the uncertainty surrounding how 
this change will impact the project. As the design for this element develops, the impact range 
can be progressively narrowed until it reaches a stage where it is appropriate to transition it out 
of the risk register and incorporate it into the base cost or schedule. 

Example: 

Description: In response to system safety efforts regarding intrusion protection, there is 
the potential that harrier walls will he required at locations x, y, and z (more locations 
possible). These harrier walls are not part of the current design or cost estimate. 

Cause/Effect: mitigation to intrusion hazard requires harrier walls / harrier walls of length 
/ (each) added at locations x, y, z 

Assessment: $10’s of Millions, likelihood: likely (65 - 90%) 

If the barrier wall was subsequently required, the probability would be changed to 100% and the 
impact narrowed as locations were solidified and wall designs developed in anticipation of this 
risk’s removal from the register and incorporation in the cost and schedule estimates as an 
additional element. 


3.2.3 Analysis 

For Regional Risk Managers and their project teams, the Analysis stage will consist of the 
prioritization of risks in anticipation of the Management stage of the process, as indicated in 
Figure 2. This will be relatively straight forward for cost risks, as the risks can, preliminarily, be 
ranked by mean exposure. For schedule risks the situation may be more complex as the 
potential exposure is not only due to the absolute value of its assessment, but also where it falls 
in the schedule. Specifically, how much float the associated activity has in relation to the 
duration of the potential delay. The Program Risk Manager will employ Monte Carlo Simulations 
for analysis in such situations as and when it is needed in support of Regional Teams’ efforts. 

The prioritization of risks that result from this analysis is intended to inform, not define, the 
prioritization developed by the regional teams in consultation with the PRM and Authority. It is 
not the exclusive means by which this prioritization is determined. In practice, this analysis will 
take place concurrently with the Regional Team’s efforts and, generally speaking, the Regional 
Team’s risk management efforts will move from Assessment to Management in accordance with 
their own preliminary prioritization of individual risks. Prioritization is discussed further in the 
following section. 


3.2.4 Management 

The discussion in this section refers specifically to activities and deliverables of the 
management stage of the Risk Management Process as given in Figure 2, not general risk 
management processes and deliverables discussed earlier. 
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Management stage tasks: 

1. Determine what management strategy is appropriate for the given risk: 

• Avoid (eliminate the probability of occurrence with, e.g. design changes), 

• Reduce (limit the potential impact and/or probability), 

• Transfer (to a third-party), 

• Accept, or 

• Optimize (in the case of opportunities); 

NOTE: any decision to ‘accept’ a risk, i.e. not develop mitigations for, or actively manage, 
the risk, must be made in consultation with the PMT 

2. Identify actions (if any) that can be taken by the Regional Team members to reduce or 
eliminate the potential impacts, likelihood of occurrence or both 

3. Specify a ‘due-date’ for all actions identified in (2.) 

4. Inform the regional Project Manager and Program Risk Manager of any risks for which 
management responsibility is more properly the responsibility of the PMT or Authority; 
specifically, when the proposed mitigation(s) require action by persons outside the 
immediate regional or system team. 

5. Identify individual team members that will take responsibility for carrying out any 
identified risk mitigations - with reference to the above strategies, if risk/opportunity is to 
be: 

a. Avoided, reduced or optimized a specific team member with the ability, both in 
terms of expertise and authority, to effectively manage the risk (or capture the 
opportunity) within the project team must be named as the responsible party; 

b. Transferred, this party must be named; 

c. Accepted, the Regional Project Manager assumes responsibility for monitoring 
this risk and periodically reassessing the advisability of this management strategy 

While the previous risk register development work in identification and assessment can be 
largely driven by the Regional Risk Managers, management decisions made during this stage 
are largely made by Regional Managers and Regional Project Managers as prioritization, choice 
of management strategy, and action assignments involve core management responsibilities. 
The principal duties for Regional Risk Managers during this stage are: 

• Assist Regional and Project Managers in development of mitigations, and more 
generally by facilitating the above tasks 

• Oversee progress on action items, ensuring action items are completed on time and 
acting as a resource for the rest of the project team 

The risk register should stand as a concise action plan. As such, it should provide the what, who 
and when of the project’s risk response and should provide answers to the following: 

> What are we going to do to limit the project’s risk exposure due to the identified 
risks? 

> Who is going to do it? 

> When is it going to be done? 
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In determining the management prioritization, Regional and Regional Consultant Managers 
should consider the following: 

• ‘Manageability’ - Have mitigations to the risk been identified? How effective are these 
mitigations likely to be? 

• Cost/Benefit - How much will the proposed mitigations cost and how does this cost 
compare with the potential cost of the risk event/situation should it occur? 

• Intangibles - how might the risk event/situation affect the project (or program as a 
whole) if it occurred in ways less tangible than additional cost or delay (e.g. reputation or 
community relations)? 

• Worst-Case Scenario (upper bound considerations) - certain risks, due to low probability 
and/or low ML and lower bound assessments, may have relatively low mean values 
despite a potentially catastrophic impact should the risk occur (as indicated by the upper 
bound of the impact assessment); these types of risks may warrant more management 
attention and resources than other risks with similar or even slightly higher mean risk 
exposure values. 

In conjunction with this prioritization or following it. Regional and Regional Project Managers can 
determine an appropriate strategy. Decisions regarding what constitutes ‘appropriate’ may be 
informed by subsequent development of mitigations. 

Per task 4, above, responsibility for the management of individual risks will be assigned to 
individuals in the best position to manage the risk; once the project team has decided that a 
particular risk should be actively managed and a general management approach is determined 
(limiting the probability of occurrence, the severity of the impact, or both): 

1. An individual with necessary expertise and authority will be assigned management 
responsibility for the particular risk; 

2. Individual action items will be determined and assigned depending on the size and 
complexity of the risk. These actions may be assigned to the same person who has 
overall management responsibility or, for larger issues, may take the form of an ad-hoc 
team of individuals in the best position to carry out mitigating actions; tasks should be 
well-defined, assigned to named individuals and have a due date. 

All risks must either be assigned to a specific Individual on regional team for 
management or, If no one on the regional team Is In a position to properly manage the 
risk, brought to the attention of the Program Risk Manager for assignment. 
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3.2.5 Monitor and Review 

The process as outlined in the previous steps is intended to be continuous and ongoing for the 
life of the project. Regional Managers, Regional Consultant Project Managers and Risk 
Managers are expected to regularly monitor and review their risk management efforts to ensure 
compliance and maintain current records of their risk management efforts. In particular: 

• Individual Risks (and opportunities) should be regularly reviewed to ensure that they 
accurately describe a current threat to project objectives, that their assessments reflect 
the best estimate of potential impacts and probability and that management strategy and 
mitigations are well-founded 

• Individual team members with management responsibility for one or more risks should 
monitor and be able to report on the above for their particular risks to their Regional Risk 
Manager 

• The Regional Manager, Regional Consultant Project Manager and Risk Manager should 
be able to identify and report on the key risks facing them at the current time 

• The status of individual mitigations should be regularly updated to reflect the current 
status of these efforts and team member responsibilities 

It is suggested that these reviews and updates of the register itself proceed on an incremental 
(continuous) basis with individual team members or functional groups - groups larger than five 
or six are not conducive to detailing individual risks, nor is it generally a productive use of most 
participants’ time. Additionally, scheduling all the individual team members who may contribute 
to any single part of the process at one time generally precludes regular reviews and leads to 
start-stop-start-stop risk management efforts and meetings largely given over to recalling what 
was discussed and decided at the previous meeting. 

It is the responsibility of the Regional Risk Manager to motivate and schedule these small-scale 
reviews and update sessions with the individual or functional groups. It is the responsibility of 
individual team members or group leads to alert the Regional Risk Manager of any changes in 
previously identified risks, or new risks that have been identified in the course of their work, in a 
timely manner. 

The entire team should review the current status as a group as the Regional Project Manager 
sees fit, though it is suggested that these meetings do not take place less often than once a 
month. These larger sessions are not intended for identification or reassessment of individual 
risks but instead as updates for the team as a whole on the big challenges facing the project, 
what is being done about them (or, in the absence of identified mitigations, discussion about 
what can be done) and general discussion about any issues on the horizon. The Regional Risk 
Manager can follow-up with individuals or smaller groups after the meeting to further develop 
and refine any issues raised at the general review meeting. 
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3.3 Documentation and Reporting 

Effective risk reporting allows management to quickly grasp the key concerns and recent 
changes, identify who has prime responsibilities for actions as well as the status of priority 
actions. The information provided needs to address the following questions: 

• “What are our key risks/showstoppers and what is being done to manage them ?” 

• “Which key risks have ineffective responses or outstanding improvement actions?” 

• “What has changed since the iast period?” 

• “What couid prevent us deiivering on the strategic program objectives and what is being 
done to mitigate these issues?” 

• ’’What is the reason for current performance gaps and do the risks and opportunities 
identified previousiy expiain this? If not, what must be done to improve our risk and 
opportunity management and our forecasting?” 

Regional teams will answer these questions with respect to both their own specific objectives 
and the larger program objectives and be diligent about alerting other organizational elements 
about any potential issue that may impact these other elements or the objectives of the program 
as a whole. 

In addition to the risk register itself and information sufficient to answer the above questions, 
Regional Risk Managers should maintain the following current records/logs: 

• A complete record of any information used as a basis for conclusions contained in the 
report, either as reference or full item 

• Explicit record of assumptions underlying all significant risks/hazards contained in the 
risk register with respect to the identification, impact assessment or management 

• Meeting log identifying subject matter, location, duration, date, participants and 
experience 

The Program Risk Manager will develop a common report format in consultation with Regional 
Risk Managers to facilitate the above and ensure consistency across regions and systems. This 
report template will be provided to Regional Risk Managers in advance of their first report. 
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Appendix A - Risk Register Template 


Risk Events Worksheet 

IDENTIFICATION 

Include enough detail for other team members to be able to form their own assessment of 
this risk and Its significance to the project 



MANAGEMENT 

Actions that may be taken by the regional project team to 
limit pessimistic (maximum) outcomes antd/or make 
optimistic (minimums) more likely 
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Risk 


Risk I.D. 
Number 
[FTA Code 
#] 

e.g. 10.04-02 for 
the second risk 
identified in FTA 
cost code 10.04 


Short Titie 


Cause 


Most Likeiy Effect 
on project 
objectives 


Categorization by 
Mitigation Timing 

1. Requirements Risk [R] 

2. Design Risk [D] 

3. Market Risk [M] 

4. Construction Risk [C] 

a. Early Construction Risk 
[C-E] 

b. Mid-Range Construction 
Risk[C-M]. 

c. Start-Up / Substantial 
Completion Risk [C-L] 


Cost 

Impact/Severity 
Estimated Range 
($) 

Assume the 
event happens, 
what is the Most 
Likely impact? 

1.10's of 
Thousands 
($10,000 to 
$100,000) 

2.10O's of 
Thousands 
($100,000 to $1 Mil) 
3. Millions ($1 to 
$10 Mil) 

4.10's of Millions 
($10 to $100 Mil) 

5. Hundreds of 
Millions (>$100 Mil) 


Schedule 
Impact/Severity 
Estimated Range 
(workdays) 
Assume the 
event happens, 
what is the 
potential 
impact? 

1. Days 

2. Weeks 

3.1 - 3 Months 

4. 3 -12 Months 

5. Year or longer 


Probability 

1. Very Unlikely 
(1 - 10 % 
Probability) 

2. Unlikely (11 - 
35%) 

3. 50/50 chance 
of occurring (36 - 
64%) 

4. Likely (65 - 
89%) 

5. Highly 
likely/Near 
certainty (90 - 
99%) 


iManagement 
I Strategy 
|l. Avoid 
12. Mitigate 
Is. Transfer 
I4. Accept 
Is. Optimize 
l(Opportunities) 


Mitigations 
Including due 
date for action 
assignments 


Responsible Party 
(if Mgmt. Strategy 
is (1), (2), (3) or 
(5) 
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Appendix B - Risk Scoring Guide 


QUANTITATIVE RANKING 



1 

2 

3 

4 

5 

Likelihood 

Very 
Unlikely 
(1 -10%) 

Unlikely 
(11 - 35%) 

50/50 
chance 
(36 - 64%) 

Likely 
(65 - 89%) 

Highly 
Likely/ 
Near 
certainty 
(90 - 99%) 

Cost 

Impact 

($) 

Tens of 
Thousands 
($10,000 to 
$100,000) 

Hundreds 

of 

Thousands 
($100,000 
to$1 Mil) 

Millions 
($1 to $10 
Mil) 

Tens of 
Millions 
($10 to 
$100 Mil) 

Hundreds 
of Millions 
(>$100 Mil) 

Schedule 

Impact 

(workdays) 

Days 

Weeks 

1-3 Months 

3-12 

Months 

Year or 
longer 


RISK MATRIX 



1 2 3 4 5 

PROBABILITY -> 


Exposure Band 



HIGH 

MEDIUM 

LOW 
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Appendix C - General Hazard Checklist 
Part A: Project Related 
Engineering 

I I Current design status / significant design development in detail design phase 
I I Complexity, constructability of design for both aerial and underground elements 

I I Increase in performance requirements/standards between now and final design 
I I Final design criteria more detailed than currently assumed 
I I Increased complexity (Civil and Systems Design) 

I I Increase in amount of underground construction 
I I Inadequate geotechnical information 

I I Insufficient research on existing facilities 
I I No precondition surveys of existing buildings/structures 
I I Requirements for new technology 

Environmental 

I I NIMBY forces realignments 

I I Noise (Construction and Operations) 

I I Construction induced dust, vibration, settlement 

I I Ground Contamination 

I I Restrictions in hours of construction 

I I Holiday Moratoriums on construction work 
I I Disruption of Services 

I I Vehicle / Pedestrian conflict 

I I Major road and traffic diversions 

□ Access needs for Emergency Services 

Third Party Impacts 

I I Potential impacts to public/private property 
I I Impacts to utilities 

I I Impacts to public transportation 

I I Loss of local business (Retail, Restaurants, Hotels) 

I I Potential for adjacent building damage 

I I Property taking and easements are underestimated 

Logistics and Schedule Impacts 

I I Contract packaging and procurement - number of contracts 
I I Advance Utility relocations 

I I Contractor interference between adjacent segments 
I I Production rates slower than assumed 

Systems - Procurement, Installation, Operations and Maintenance 

I I Procurement of new / additional rolling stock 
I I Communications 

I I OCS and Signaling 

I I Special Trackwork 

I I Traction Power / substations 

I I Station facilities 
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Part B: Programmatic 

I I Political advocacy for the project / 

I I Public acceptance / Local opposition groups 

I I Potential for major change in project alignments 

I I “Missing” segments within a corridor 

□ New Regulatory Requirements 

I I Potential for stoppages by other parties or situations 

I I Timeliness of FT A, State, City, and Local Agency permits 

I I Discovery of Archeological Sites 

I I Identification of Historic Sites 

I I Sources/Availability of funding 

I I Synchronization of projects and funding 

I I Inflation and increase in borrowing rates 

I I Major increase in raw material prices 

□ Cost Escalation due to delays in starting projects 

I I Fluctuations in US$ exchange rates 

I I Fluctuations in property values 

I I Contracting Climate - Unacceptable bid responses 

I I Workload/Capacity of regional contractors / availability of skilled workforce 
I I Labor relations / regulations / disputes/ strikes 

I I Competing activity on selected sites/availability of access to work when required 
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